Stack-based buffer overflow in img.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a crafted length field in a packet.

The version of HP Intelligent Management Center running on the remote host contains a number of vulnerabilities that can be exploited remotely without authentication, including code execution and arbitrary file creation.

According to its version number, the HP Intelligent Management Center install on the remote host is potentially affected by multiple vulnerabilities :

  - A stack-based buffer overflow vulnerability exists in     the 'img.exe' component. (CVE-2011-1848)

  - A flaw exists in the 'tftpserver.exe' component which     could allow arbitrary file creation when handling WRQ     opcode types. (CVE-2011-1849)

  - A stack-based buffer overflow vulnerability exists in     the 'dbman.exe' component. (CVE-2011-1850)

  - A stack-based buffer overflow vulnerability exists in     the 'tftpserver.exe' component. (CVE-2011-1851)

  - A stack-based buffer overflow vulnerability exists in     the 'tftpserver.exe' component. (CVE-2011-1852)

  - A buffer overflow vulnerability exists in the     'tftpserver.exe' component when handling a large or     invalid opcode word of a packet. (CVE-2011-1853)

  - A use-after-free vulnerability exists in the     'imcsyslogdm.exe' component. (CVE-2011-1854)

Versions of HP Intelligent Management Center earlier than 5.0 E0101-L02 are potentially affected by multiple vulnerabilities : 

  - A stack-based buffer overflow vulnerability exists in the 'img.exe' component. (CVE-2011-1848)

  - An unspecified vulnerability in the 'tftpserver.exe' component exists which could allow an attacker to create arbitrary files on the server. (CVE-2011-1849)

  - A stack-based buffer overflow vulnerability exists in the 'dbman.exe' component. (CVE-2011-1850)

  - Multiple buffer overflow vulnerabilities exist in the 'tftpserver.exe' component. (CVE-2011-1851, CVE-2011-1852, CVE-2011-1853)

  - A use-after-free vulnerability exists in the 'imcsyslogdm.exe' component. (CVE-2011-1854)

ID	Name	Product	Family	Severity
54999	HP Intelligent Management Center Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical
54628	HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities	Nessus	Windows	critical
5927	HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2011-1848

critical

Tenable Plugins

critical

critical

critical